Online CBD Sales: Why It’s Still Buyer Beware · Vaping is a category unto itself,15 and we...
40
Online CBD Sales: Why It’s Still Buyer Beware October 2019
Transcript of Online CBD Sales: Why It’s Still Buyer Beware · Vaping is a category unto itself,15 and we...
Online CBD Sales: Why It’s Still Buyer Beware October 2019
legitscript.com | 877-534-4879 | [email protected]
1. Introduction 3 1.1 A Historical Overview of CBD 3
2. LegitScript’s Online CBD Survey 5 2.1 CBD Product Types 6
2.2 Jurisdictional Compliance 10
2.3 Marketing Claims 12
2.4 Payment, Shipping, and Sources of Supply 18
3. Product Testing 21 3.1 Potency 23
3.2 Heavy Metals 25
3.3 Solvents 26
4. Financial Crimes and High-Risk Behavior 29 4.1 Transaction Laundering 29
4.2 Offshore Processing 32
4.3 Other High-Risk Behavior 33
5. Conclusion and Recommendations 38 5.1 Solutions 39
2
TABLE OF CONTENTS
legitscript.com | 877-534-4879 | [email protected]
1. Introduction
Whether $20 billion by 2024 or $22 billion by 2022, market research indicates that 1
cannabidiol (CBD) sales are poised for massive expansion. Some CBD advocates are eager to send the industry off into unbridled flight; however, as with other high-risk industries such as pharmaceuticals, online gambling, and addiction treatment, this report argues that a mix of public oversight and private voluntary efforts are needed to protect CBD consumers.
Despite the variety of applications CBD may have as a wellness product, three factors — danger to consumers, a relative dearth of research, and an absence of government oversight — inhibit the largest segments of the CBD market, particularly dietary supplements and food products. The industry exists in a state of tension, eager to pull away as regulators scramble to develop a framework that will allow the industry to flourish while protecting consumers.
In this report, we look at what is really going on in the CBD market from a consumer safety perspective. In preparing this report, LegitScript reviewed hundreds of websites selling CBD to gauge their levels of compliance, had dozens of CBD products tested for potency and safety, and investigated high-risk financial behavior that allows the industry to accept credit cards or other payments even when large swaths of it are violating state and federal laws. After sharing our findings, this report offers solutions that can help bring CBD manufacturers and sellers into compliance, and gives payments companies, as well as online advertising and e-commerce platforms, the confidence they need to partner with CBD merchants.
1.1 A Historical Overview of CBD
The United States has had a long and fraught relationship with hemp. The crop was a staple during the time of the American Revolution, and was used to produce canvas, 2
cables, cordage, paper, and other vital materials. A letter from the Secretary of Navy to the US Senate in 1824 explained that “the places where, and the extent to which, hemp may be cultivated in the United States, it may be unreservedly said that the climate throughout the whole country is nowhere unfriendly.” 3
https://bdsanalytics.com/u-s-cbd-market-anticipated-to-reach-20-billion-in-sales-by-2024/ 1
https://www.brightfieldgroup.com/post/cbd-worth-22-billion-by-2022
https://www.history.org/foundation/journal/winter15/hemp.cfm2
https://books.google.com3
3
legitscript.com | 877-534-4879 | [email protected]
But that changed with the Marihuana Tax Act of 1937, which required most farmers to have a tax stamp to grow cannabis. Although the act only prohibited use of the plant as a recreational drug, the hemp industry was effectively strangled. According to US Customs and Border Patrol, “industrial hemp was caught up in anti-dope legislation, making hemp importation and commercial production in this country less economical.” 4
A few years later, in 1940, the compound cannabidiol (CBD) was identified in wild hemp and first studied by researchers in collaboration with universities and the US Treasury Department. At the time, the researchers regarded the phytocannabinoid as 5
toxic but noted that it had “no marihuana activity.” Although the Marihuana Tax Act was deemed unconstitutional in 1969, the Controlled Substances Act (CSA) in 1970 6
listed cannabis as a Schedule I controlled substance, the most restricted category. 7 8
This may have stunted research into CBD. According to a study published in 2017 by the National Institutes of Health (NIH), “these legislative actions contributed to creating limitations on research by restricting procurement of cannabis for academic purposes.” 9
Today, looser restrictions for hemp-derived CBD introduced in the 2018 Farm Bill are 10
awakening an opportunity in CBD. The excitement over the potential of CBD, whether for medical or non-medical purposes, arguably exceeds what the science has shown, and what regulators are empowered to do. As much potential as manufacturers, 11
investors, and payments companies see in CBD, its true future may lie in how local and federal governments approach consumer safety in coming years.
https://www.cbp.gov/about/history/did-you-know/marijuana4
https://pubs.acs.org/doi/abs/10.1021/ja01858a0585
https://supreme.justia.com/cases/federal/us/395/6/6
https://www.govinfo.gov/content/pkg/STATUTE-84/pdf/STATUTE-84-Pg1236.pdf (See page 1249.)7
https://www.dea.gov/drug-scheduling8
https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5312634/9
https://www.legitscript.com/dl/cbd-hemp-guide/10
https://www.nytimes.com/interactive/2019/05/14/magazine/cbd-cannabis-cure.html11
4
legitscript.com | 877-534-4879 | [email protected]
2. LegitScript’s Online CBD Survey
As of October 2019, LegitScript market research indicated that somewhere between 10,000 and 13,000 merchants were selling CBD on the internet. This includes not only dedicated CBD sellers, but also tobacco shops, grocery stores with e-commerce functionality, traditional dietary supplement vendors, general wellness websites, cosmetics companies, and more. This number is highly dynamic, and appears to be growing fast.
In late summer 2019, LegitScript conducted a survey of online CBD sellers to better understand the state of regulatory compliance in the e-commerce sector. Although there are many considerations in the realm of CBD compliance, we focused on what we consider to be the three primary types off regulations designed to protect consumers: the types of products sold; the shipping locations of buyers and sellers; and the marketing or health-related claims a seller makes about CBD’s potential to cure, treat, or prevent diseases.
For our survey, LegitScript conducted searches on popular search engines (Google and Bing) from a US IP address using more than 40 keywords and phrases related to the sale of CBD (e.g., “buy CBD” and “best CBD online”). Our searches went five pages deep — more than a typical internet user — to ensure a sufficient number of results. We surveyed 300 websites for this report, beginning generally from the top down of 12
our results, and including only websites that marketed CBD for sale online and offered shipping to the US. Our results found that 294 of the surveyed websites (98%) were noncompliant in at least one of the three categories. Furthermore, 46% were noncompliant in two categories, and 37% were noncompliant in all three categories, meaning that 83% were noncompliant in two or more categories.
https://www.protofuse.com/blog/details/first-page-of-google-by-the-numbers/12
5
98% of CBD
websites LegitScript
surveyed were
noncompliant in one
or more of the three
major categories.
legitscript.com | 877-534-4879 | [email protected]
FIG 1: THE OVERALL BREAKDOWN OF THE 294 NONCOMPLIANT CBD WEBSITES SURVEYED
In the following subsections, we explain more about the types of noncompliance with consumer protection regulations we identified and provide examples. In Section 5, we offer recommendations for how online CBD sellers can make fixes — often relatively easy ones — to come into compliance.
2.1 CBD Product Types
Under federal law as updated by the 2018 Farm Bill, CBD is still considered a controlled substance when extracted from “marihuana,” but CBD derived from hemp is exempt as long as it contains less than 0.3% THC, the psychoactive ingredient in cannabis.
This doesn’t mean, however, that hemp-derived CBD is automatically legal for all uses, whenever and wherever.
4%13%
4%
4%
38%
37%
Products, Shipping, and Claims Products and Shipping OnlyProducts and Claims Only Shipping and Claims OnlyProducts Only Shipping Only
6
legitscript.com | 877-534-4879 | [email protected]
According to the FDA, under the Food, Drug, and Cosmetic Act (FDCA), it is illegal to market CBD as a dietary supplement or otherwise introduce it into the food supply. The FDCA states that products containing a substance that is an active ingredient in an FDA-approved drug product, or which is subject to an investigational new drug application (and for which substantial clinical investigations have been made public), do not meet the definition of dietary supplement and may not be sold as such, and may not be added to food. This includes CBD products intended to be ingested by pets or other animals. The agency has issued multiple warning letters 13
against manufacturers of CBD products for marketing their products as dietary supplements. 14
In our research, 91.7% of surveyed websites sold noncompliant CBD products, often dietary supplements such as capsules and tinctures, or food products containing CBD such as gummies, syrup, honey, chocolate, and water.
FIG 3: EXAMPLES OF EDIBLE CBD PRODUCTS
https://www.fda.gov/consumers/consumer-updates13
https://www.fda.gov/news-events/public-health-focus14
7
8%
92%
Sold Noncompliant CBD ProdcutsSold Only Compliant CBD Products
FIG 2: PRODUCT COMPLIANCE
legitscript.com | 877-534-4879 | [email protected]
Another popular noncompliant category is animal-related CBD products, which come in the form of ingestible oil, chews, biscuits, jerky, and more.
FIG 4: EXAMPLES OF PET PRODUCTS CONTAINING CBD
CBD oils and tinctures are not inherently problematic: these products are sometimes used for topical application and, depending on the circumstance, may be legal. These products may be considered noncompliant when they are flavored (indicating use for ingestion) or the directions suggest ingestion as the intended use.
FIG 5: CHOCOLATE MINT-FLAVORED CBD OIL
8
legitscript.com | 877-534-4879 | [email protected]
Vaping is a category unto itself, and we surveyed a number of websites that featured 15
CBD vaping cartridges (“vape carts”) as a primary offering. We did not count these as noncompliant products: as of the publishing of this report, the FDA and other federal authorities have not provided clear guidance on CBD in vaping products. However, the products may present risk. The FDA has taken aggressive action against vaping in 2019 in the midst of an epidemic of youth e-cigarette use and vaping-related illnesses and deaths. These actions have focused on vaping cartridges containing nicotine 16
(especially ones flavored to appeal to youths) and ones containing THC, which is a controlled substance. Accordingly, while we did not count CBD vaping products as noncompliant as we wait for clarity on the FDA’s viewpoint, this report should not be read to suggest that CBD vaping products are safe or compliant.
A variety of hemp-derived CBD products are generally permissible at the federal level, including cosmetics and topicals such as creams, lotions, massage oils, and roll-on sticks. The only FDA-approved prescription drug containing CBD is Epidiolex, which is used to treat rare, severe forms of epilepsy and may be lawfully prescribed. 17
2.1.1 Websites Offering THC and Other Problematic Products
Of the 300 websites we surveyed that sold some form of CBD, only six (2%) marketed THC products, and it appeared that none offered online sales (rather, they pointed to physical locations in which their products were sold). This seems to indicate a distinct separation between the CBD industry and the marijuana industry.
Six websites in our survey offered kratom, a product often marketed as an herbal 18
supplement but listed as a Drug of Concern by the Drug Enforcement Administration. One website sold impermissible nootropic products and phenibut, 19
an ingredient that does not meet the statutory definition of a dietary supplement. 20
https://www.legitscript.com/dl/vaping-and-e-cigarettes-faq/15
https://www.fda.gov/news-events/press-announcements/fda-takes-new-steps-address-epidemic16
https://www.fda.gov/news-events/press-announcements/fda-approves-first-drug17
https://www.legitscript.com/dl/kratom-faq/18
https://www.dea.gov/sites/default/files/sites/getsmartaboutdrugs.com/files/publications19
https://www.fda.gov/food/dietary-supplement-products-ingredients/phenibut-dietary-supplements20
9
legitscript.com | 877-534-4879 | [email protected]
2.2 Jurisdictional Compliance
Since the passage of the 2014 Farm Bill, which opened the door for the legal cultivation of hemp in the US, there has been considerable confusion about the status of hemp-derived CBD and an inaccurate belief that these products are legal in all 50 states. These misunderstandings have only multiplied since the passage of the 2018 Farm Bill, which explicitly removed hemp from the federal controlled substance schedules.
The short answer is: while the 2018 Farm Bill prevents states from prohibiting the transport of legally cultivated hemp products, states preserve their authority to otherwise regulate hemp and CBD products, so a product legal at the federal level may still be illegal in one or more states. The result is a patchwork of regulatory approaches: some states outright prohibit CBD, some only prohibit certain types of products, and others have limitations on how and where CBD products may be sold — even if the product is legal federally. 21
In our website survey, we proceeded through the checkout process of each website using contact information unattributable to LegitScript. We were able to select shipping destinations to states where CBD is generally not permitted, such as South Dakota, where all forms of CBD are illegal, according to the state’s attorney general. 22
Out of 300 websites, 250 (83.3%) appeared to offer shipping to states where CBD is prohibited.
https://www.legitscript.com/dl/us-state-cbd-laws-you-need-to-know-about/21
https://atg.sd.gov/OurOffice/Media/pressreleasesdetail.aspx?id=216722
10
17%
83%
Offered Shipping to Noncompliant StatesRestricted Sales to Noncompliant States
FIG 6: JURISDICTIONAL COMPLIANCE
legitscript.com | 877-534-4879 | [email protected]
FIG 7: AN ONLINE CBD SELLER OFFERS SHIPPING TO SOUTH DAKOTA.
FIG 8: AN ONLINE CBD SELLER STATES THAT SHIPPING TO ALL 50 US STATES IS LEGAL.
The remaining websites appeared to have controls in place to prevent shipping to jurisdictions where CBD is illegal. In some instances, these states were unlisted in the drop-down menu when we tried to enter a shipping address, which is a best practice for regulatory compliance. In other instances, we received an error message when we chose a state in which CBD is prohibited — another recommended approach.
FIG 9: A WEBSITE’S CHECKOUT GIVES AN ERROR MESSAGE ABOUT SHIPPING.
11
legitscript.com | 877-534-4879 | [email protected]
FIG 10: A SHIPPING DROP-DOWN MENU OMITS SOUTH DAKOTA AS AN OPTION.
2.3 Marketing Claims
Perhaps the area of noncompliance that has drawn the most regulatory scrutiny is that of the marketing claims, usually related to health benefits, made about CBD products. Food, beverages, cosmetics, dietary supplements, and animal foods may not include claims that they are intended to diagnose, cure, mitigate, treat, or prevent disease. This issue was 23
addressed by FDA officials in a July 2019 statement regarding CBD: “[I]f a product is being marketed as a drug — meaning, for example, that it’s intended to have a therapeutic effect such as treating a disease — then it’s regulated as a drug, and it generally cannot be sold without FDA approval … .” 24
In April 2019, then-FDA Commissioner Scott Gottlieb expressed concern about marketing claims (also called health claims or disease claims) being made during the
https://www.federalregister.gov/documents/2002/01/09/02-451/small-entity-compliance-guide23
https://www.fda.gov/news-events/fda-voices-perspectives-fda-leadership-and-experts24
12
55%45%
Website Had Impermissible ClaimsWebsite Had No Egregious Claims
FIG 11: MARKETING CLAIMS
legitscript.com | 877-534-4879 | [email protected]
sale of CBD, and stated that it would be a focus of compliance actions: “I am deeply concerned about any circumstance where product developers make unproven claims to treat serious or life-threatening diseases, and where patients may be misled to forgo otherwise effective, available therapy and opt instead for a product that has no proven value or may cause them serious harm.” 25
Despite this clear warning, LegitScript identified numerous claims by CBD sellers stating that CBD could treat diseases and conditions such as cancer, Alzheimer’s, clinical depression, anxiety, fibromyalgia, inflammation, chronic pain, traumatic injury, and more. Of the 300 websites we surveyed, 135 (45%) included impermissible claims that products could treat serious diseases. Some samples are below.
FIGS 12-15: EXAMPLES OF DISEASE CLAIMS ON WEBSITES
https://www.fda.gov/news-events/press-announcements/statement-fda-commissioner-scott-gottlieb25
13
legitscript.com | 877-534-4879 | [email protected]
In addition to website content and product labels, these types of claims are also impermissible to make on social media accounts controlled by the seller. In July 2019, the FDA issued a warning letter to Curaleaf, Inc. for a long list of marketing claims made not only on the company website but also on its Facebook and Twitter accounts. 26
https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/curaleaf26
14
legitscript.com | 877-534-4879 | [email protected]
FIG 16: AN EXAMPLE OF A CBD SELLER MAKING DISEASE CLAIMS ON FACEBOOK
FIG 17: A SELLER MARKETS CBD FOR THE TREATMENT OF CANCER ON INSTAGRAM.
15
legitscript.com | 877-534-4879 | [email protected]
Many CBD sellers may not realize that they also can be held responsible for third-party content hosted on their websites, such as customer testimonials. For example, an October 2017 warning letter to a CBD seller specifically cited a customer testimonial stating that the product treated the user’s arthritis and traumatic brain injury. In our 27
website survey, LegitScript observed frequent examples of problematic testimonials:
FIGS 18-23: EXAMPLES OF DISEASE CLAIMS IN TESTIMONIALS ON CBD WEBSITES
https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/natural27
16
legitscript.com | 877-534-4879 | [email protected]
2.4 Payment, Shipping, and Sources of Supply
Most of the websites we surveyed — both compliant and noncompliant — accepted major credit cards. Based on LegitScript’s experience in monitoring merchants, we believe many are transacting through offshore payment processors (see Section 4.2 for more on this). Less frequently, merchants accepted eCheck, PayPal, cryptocurrency, or wire transfer for payment.
FIG 24: NUMBER OF SURVEYED WEBSITES ACCEPTING VARIOUS PAYMENT METHODS
During the checkout process, some websites gave error messages that their credit card processing was down; this may indicate that the seller’s merchant account was revoked, though we were unable to confirm this. Websites sometimes redirected customers to other websites, and other times asked customers to pay using alternative methods such as eCheck.
FIG 25: EXAMPLE OF A PAYMENT PROCESSING ERROR MESSAGE
We identified shipping methods listed on 96 of the surveyed websites. Most of these used just one courier, but 12 of the 96 listed multiple couriers. The vast majority used the United States Postal Service (USPS) to ship their products. LegitScript has separately expressed concern about the degree to which USPS is used as a shipping method for illegal substances. 28
0
75
150
225
300
Mastercard Visa Amex Discover eCheck/Other PayPal Crypto Wire Transfer
32141
81
127148
230238
https://www.hudson.org/research/13401-crisis-in-the-mail-fixing-a-broken-international-package-system28
18
legitscript.com | 877-534-4879 | [email protected]
FIG 26: SHIPPING METHODS OF 96 SURVEYED WEBSITES POSTING COURIER INFORMATION
We note that USPS and UPS permit the shipment of CBD products that adhere to all applicable laws under strict guidelines. FedEx prohibits the shipment of CBD 29
products altogether. 30
Most of the websites we surveyed (85%) marketed their own branded products. The rest were affiliates or retail e-commerce stores. Only 20 (6.7%) websites selling branded products stated that that were the manufacturer/processor of the CBD they sold. Additionally, nine websites we surveyed offered private labeling services.
FIG 27: BRANDED PRODUCTS MARKETED ON SURVEYED WEBSITES
0
20
40
60
80
USPS UPS FedEx DHL Royal Mail
361111
78
1%14%4%
7%
74%
Branded Products OnlyBranded, Manufactured ProductsBranded and Third-Party ProductsRetail (Third-Party Products Only)Affiliate
https://about.usps.com/postal-bulletin/2019/pb22521/html/updt_002.htm 29
https://www.ups.com/us/en/help-center/packaging-and-supplies/special-care-shipments/hemp.page
https://www.fedex.com/content/dam/fedex/us-united-states/services/SG_TermsCond (See page 12.)30
19
legitscript.com | 877-534-4879 | [email protected]
The vast majority of websites with branded products did not state their sources of supply, or gave vague information (e.g., “Made from USA-grown hemp!”).
Most surveyed websites did identify their bases of operation. More than one-third (37%) of businesses listed locations in California or Colorado, and more than half (53.7%) were located in one of the top four states: California, Colorado, Florida, and Oregon. We were unable to identify a business location for 14 (4.7%) websites.
FIG 28: MAP OF STATED BUSINESS LOCATIONS OF SURVEYED WEBSITES
Many websites listed both a US and European location, which we believe may have to do with their payment processor (see Section 4.2). Other contact information listed on websites — such as phone numbers and social media accounts — indicated that business operations likely take place at the US addresses.
20
legitscript.com | 877-534-4879 | [email protected]
3. Product Testing
Although lab testing is critically important to ensure product safety in the CBD industry, our analysis indicates that a minority of sellers are complying with that best practice.
Why is lab testing important? The first reason is that testing helps CBD sellers make sure they are within the legally allowable limits of THC. Hemp farmer Bryan Sawyer told Hemp Magazine in an October 2018 article: “This is new to all of us, so we don’t know if there’s environmental impact [on THC levels] if, say, a big cold front comes through or if the barometric pressure affects anything. If you give them too much phosphates, potash, or microbes, what does it do to them? All that stuff people are still figuring out.” 31
Second, testing helps to ensure potency, especially if the CBD is being manufactured irregularly or in small batches. When the FDA tested 24 products in 2016, only two products 32
passed the agency’s test for having the amount of CBD in the product that matched the amount claimed on product labels.
Third, it helps to protect consumer safety. According to the cannabis directory WeedMaps, “[c]annabis plants act as a sponge during cultivation and absorb everything to which they’re exposed.” This can include harmful substances such as pesticides, heavy metals, and more — 33
a problem discussed in the following subsections.
Despite these dangers to consumers, most online sellers we reviewed in our website survey — 63.3% — posted no lab results. (Of course, merely posting lab tests by itself does not guarantee that the lab tests are accurate or performed by an unbiased tester.) Many of these websites marketed their products as lab tested but provided no verification or additional information as to the results. Fourteen websites we surveyed posted partial lab results (for some products but not all), and 24 websites posted lab results we considered old (more than a year old at the time of our review with no indication that the product being sold was part of the batch tested). Only 72 websites (24%) posted complete, current lab results.
https://thehempmag.com/2019/06/the-trouble-with-lab-testing-in-the-hemp-cbd-oil-industry/31
https://www.fda.gov/news-events/public-health-focus/warning-letters-and-test-results-cannabidiol32
https://weedmaps.com/learn/the-plant/does-cannabis-need-to-be-tested/33
21
legitscript.com | 877-534-4879 | [email protected]
FIG 29: WEBSITE SURVEY FINDINGS FOR POSTED LAB RESULTS
As part of this report, we tested 30 CBD products to better understand the state of product quality and safety. We chose products from among the websites that appeared high in search results of our website survey (see Section 2 for our methodology) to mimic what a typical potential customer might find and purchase. We used discretion in choosing CBD products: oils and tinctures, supplements, food products, pet products, topicals, and vape oil.
Products needed to meet the following criteria for testing:
1. The website accepted a major credit card or PayPal;
2. The seller offered shipping to the US;
3. The product listed the amount of CBD it contained; and
4. The product purported to have allowable amounts of THC (no more than 0.3%).
We submitted these products to EVIO labs in Berkeley, California, one of LegitScript’s trusted partner labs for its CBD Certification program. 34
https://www.legitscript.com/service/certification/cbd/34
22
24%
8%
5%63%
Posted No Lab Results Posted Partial Lab ResultsPosted Old Lab Results Posted Complete, Current Results
legitscript.com | 877-534-4879 | [email protected]
3.1 Potency
LegitScript found that 20 out of 30 products tested (66.7%) contained significant deviations in the amount of CBD they contained. We considered a deviation significant if it was 20% or more. Sixteen products contained significantly less CBD than stated, and four contained significantly more CBD than stated. Nine out of 30 products (30%) had less than half the amount of stated CBD. In three cases, there was less than 10% of the stated CBD.
In one instance, a product contained only 1% of the amount of CBD it said it had — effectively zero. In another instance, a product contained more than twice the amount of CBD it said it had (107% more).
The graph on the following page shows the percent deviation from the amount that tested CBD products stated they had. Bars closer to the center show less deviation, meaning that their actual potency was closer to their stated amount. Bars further from the center reflect greater potency deviation, either positive or negative.
Only eight of the 30 products tested were within a 10% deviation of their stated CBD amounts.
See the graph on the following page
23
legitscript.com | 877-534-4879 | [email protected]
FIG 30: PERCENT DEVIATION FROM PRODUCTS' STATED AMOUNT OF CBD
* This product failed the heavy metals test.
† This product failed the solvents test.
P1
P2
P3
P4
P5
P6*
P7
P8
P9
P10
P11
P12
P13
P14
P15
P16
P17
P18
P19
P20
P21
P22
P23
P24
P25
P26
P27
P28
P29
P30
-120% -90% -60% -30% 0% 30% 60% 90% 120%
Percentage Less Potent Percentage More Potent
24
†
legitscript.com | 877-534-4879 | [email protected]
3.2 Heavy Metals
Heavy metals in soil have long been a concern in agriculture, and are of particular 35
concern to cannabis farmers. This is in part because cannabis products are often smoked, which is a particularly effective method for intake into the body, according to Michael Straumietis, a cannabis farming expert, in a June 2017 interview with the Cannabis Business Times. 36
The other concern is that cannabis acts like a sponge. “Cannabis is unique because it’s an accumulator plant — it takes up everything from its environment,” Straumietis said. “Heavy metals typically accumulate in the plant through the root system. This can include fertilizers with large amounts of heavy metals or contaminated soil. Even water from contaminated soils can carry heavy metals and be absorbed by the plant.”
For this reason, CBD manufacturers and sellers often test for metals such as arsenic, cadmium, cobalt, copper, lead, and mercury.
Of the products LegitScript tested, one contained impermissible levels of lead, failing the heavy metal test. This product contained 9.2618 parts per million (PPM) of lead when the allowable limit is 0.5 PPM. That equates to 18.5 times the allowable amount of lead in a product per California standards, which are a set of standards that are commonly used in cannabis testing.
According to a study on lead toxicity published by the NIH in 2015, “Most pharmaceutical companies have set a limit for maximum daily intake of lead as 1.0 μg/g [PPM], however prolonged intake of even this low level of lead is hazardous to human beings.” 37
https://www.researchgate.net/publication/305627542_Heavy_metals_in_agricultural_soils35
https://www.cannabisbusinesstimes.com/article/advanced-nutrients-heavy-metals-in-crops/36
https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4961898/37
25
A person taking a
typical dose of this
CBD product would
be consuming
between 16.7 and
50.2 times the daily
recommended limit
of lead.
legitscript.com | 877-534-4879 | [email protected]
How much lead would a person using this product take in each day? The product was a 30g bottle of ingestible oil with 250mg of CBD. There is no set CBD dosing standard, and recommendations can range from as little as 2.5mg per day to hundreds of milligrams per day. Common dosing recommendations LegitScript has 38
seen for regular users taking moderate doses is somewhere between 15mg and 45mg per day, depending on a person’s weight, tolerance, and desired outcome.
In our lead-tainted product with 250mg of CBD, that range would translate to between 16.7and 5.6 doses in a bottle. The bottle’s total volume is 30g, meaning a 15mg CBD serving would take 1.8g of total liquid and a 45mg serving would take 5.4g of total liquid. Therefore, a person taking a typical dose of this product would be consuming between 16.7μg and 50.2μg of lead (somewhere between 16.7 and 50.2 times the daily recommended threshold for lead).
To put this in context, the EPA requires operators of water systems to take action if water contains more than 15 parts per billion (PPB). The water in Flint, Michigan, was 39
tested at lead levels between 158 PPB and 13,000 PPB, according to the Washington Post. Water at 5,000 PPB is considered toxic waste, according to the article. The 40
product we submitted that failed the heavy metals test contained 9,262 PPB of lead. Simply put, the CBD product tested positive as equivalent to toxic waste.
3.3 Solvents
There are many methods of extracting CBD from the cannabis plant, such as CO2 extraction, steam distillation, hydrocarbon solvent extraction, and more. There is no 41
industry standard, and each method has its benefits and drawbacks. One of the risks of hydrocarbons is residual solvents left over in the extraction process. 42
https://purekana.com/blogs/news/how-to-take-cbd-general-dosage-guide/ 38
https://www.cbdoil.org/cbd-dosage-guide/ https://www.healthline.com/health/cbd-dosage#research
https://www.epa.gov/ground-water-and-drinking-water/basic-information-about-lead-drinking-water39
https://www.washingtonpost.com/news/wonk/wp/2016/01/15/this-is-how-toxic-flints-water-really-is/40
https://www.marijuanabreak.com/cbd-cannabis-extraction41
https://www.analyticalcannabis.com/articles/residual-solvent-analysis-ensuring-the-safety-of-cannabis42
26
legitscript.com | 877-534-4879 | [email protected]
According to the CBD Awareness Project, a CBD advocacy group, solvent extraction is an efficient and inexpensive extraction method, but it can pose risks to consumers: “[T]he solvents used in hydrocarbon extraction (including naphtha, petroleum, butane, or propane) create cause for concern. The solvent residue can be toxic and increase one’s cancer risk if they aren’t fully eliminated during the evaporation step—which doesn’t always happen.” 43
One of the CBD products we tested — a topical cream — failed the solvents test. (This was a different product from the one that failed the heavy metals test.) This product contained 5.6 times the allowable amount of ethylene oxide, per California standards.
The EPA has identified ethylene oxide in gas form as one of the 33 most hazardous air pollutants posing the greatest human health risk in the largest number of urban areas, according to the National Resources Defense Council. The World Health Organization’s 44
International Agency for Research on Cancer lists ethylene oxide as a known carcinogen, linked especially to leukemia and lymphoma. 45
Michele Malaret, Vice President of Client Services at EVIO Labs, told LegitScript that their lab has been seeing residual solvents more frequently in CBD than in marijuana products. This may be because cannabis has faced more intense scrutiny over a longer period of time, leading to more stringent standards.
“I’m not surprised to see residual solvents in somewhat high levels [in CBD],” Malaret said. “That’s been a recent thing we’ve been seeing in quite a few of the CBD products, probably more than we’ve been seeing on the cannabis side.”
Solvents can be highly flammable and explosive, posing a danger both during the extraction process and in testing. After experiencing some products exploding during
https://www.cbdoil.org/cbd-extraction-methods/ 43
https://mjbizdaily.com/choosing-the-right-cannabis-extraction-method/
https://www.nrdc.org/experts/jennifer-sass/ethylene-oxide-chemical-industrys-defense-cancer-risk44
https://www.ehs.uci.edu/programs/sop_library/CARCIN.pdf (See pages 6 and 15.)45
27
One product we
tested contained 5.6
times the allowable
amount of ethylene
oxide, a known
carcinogen.
legitscript.com | 877-534-4879 | [email protected]
the heavy metals testing portion, EVIO has been checking with clients about the contents of the products before performing testing.
“We ask our customers if they know if there are solvents in their product, and unfortunately a lot of times they don’t know because they’re getting their concentrate from another manufacturer,” Malaret said.
Although most CBD sellers who test their products likely do so to ensure product quality and protect consumer safety, that isn’t the case for everyone. Malaret describes one customer whose product tested positive for 11 times the limit of one solvent, but who still planned to sell it.
“What was concerning is that this particular person wanted to still market the product and wanted us to remove the test,” Malaret said. “We did not do that.”
28
legitscript.com | 877-534-4879 | [email protected]
4. Financial Crimes and High-Risk Behavior
Because of the complex regulatory area in which the CBD market exists, many payment service providers are hesitant to issue merchant accounts for CBD manufacturers, sellers, and retailers, especially those selling online using card-not-present (CNP) transactions. The 46
result is that CBD sellers — even those operating in total compliance — may have difficulty processing credit card payments.
If online CBD sellers are unable to obtain a merchant account in the US, they face difficult options. Some of the merchants we observed have pursued the following solutions:
1. Some CBD sellers attempt to conduct business outside of the credit card ecosystem, using methods such as eCheck or cryptocurrency, but they risk losing a significant portion of their business as a result.
2. Some CBD sellers seek out offshore payments companies or ones that specialize in high-risk merchant accounts, but will typically pay higher fees and risk dealing with a company outside of US jurisdiction. 47
3. Some CBD sellers set up transaction laundering operations, a serious offense that can incur steep penalties and immediate account termination if caught by the card brands, as well as law enforcement action for money laundering and other crimes if detected by regulators.
In the following subsections, we look at financial crimes and other high-risk behavior that keep parts of the CBD industry running.
4.1 Transaction Laundering
Transaction laundering refers to the processing of payments through a merchant account underwritten by a payment provider on behalf of a different merchant, which is not known to, approved by, or underwritten by the payment provider. (In other words, an applicant gets a Visa or Mastercard account by telling the bank they are going to sell shoes or T-shirts, but instead routes payments for other, often illegal
https://emerchantbroker.com/blog/why-elavon-dropped-cbd-merchant-accounts/46
https://chargebacks911.com/high-risk-credit-card-processing/47
29
legitscript.com | 877-534-4879 | [email protected]
products, through that account.) It is sometimes also referred to as “factoring” or “undisclosed aggregation.” For acquiring banks and ISOs, transaction laundering is frustrating and costly to mitigate. Although transaction laundering is among the most difficult practices to identify in payment processing, LegitScript specializes in transaction laundering detection and knows what risk factors to look for.
One way to identify a merchant at risk for transaction laundering is to make a purchase and then compare the website and company name to the merchant descriptor, the line that identifies transactions on a cardholder’s account statement. In the example below, an online CBD seller lists two merchant descriptors and warns customers that their statement may show the description “ESSENTIAL CELLULAR SMCMINNVILLE OR.” This apparently unrelated merchant descriptor presents risk, in LegitScript’s experience.
FIG 31: AN ONLINE CBD SELLER LISTS TWO POSSIBLE MERCHANT DESCRIPTORS.
We did not make a test purchase from this particular seller and did not confirm transaction laundering.
4.1.1 Transaction Laundering From Our Purchases
When we purchased the 30 CBD products that we submitted for lab testing (see Section 3), we used credit cards unattributable to LegitScript. After conducting the purchases, we reviewed merchant descriptor information on our statements. Most of the descriptors were clearly identifiable as associated with the merchant’s website or company name. For example, the website hempbombs.com had the merchant descriptor “Hemp Bombs.”
Based on LegitScript’s years of experience in evaluating merchants for transaction laundering risk, we observed some descriptors that indicated that the sellers present a risk for transaction laundering. For example, a test purchase from the website
30
legitscript.com | 877-534-4879 | [email protected]
cbdrustore.com resulted in the merchant descriptor “Mother Earth Merchandise.” The address listed on the merchant’s website is a virtual office in Anaheim, California, and makes no mention of the company name or anything related to the merchant descriptor.
An internet search for “Mother Earth Merchandise” enabled us to find the Wyoming-incorporated company Mother Earth Merchandise, LLC, which lists its principal place of business as 4354 Village Drive, Unit E, Chino Hills, California 91709. The same 48
address appears on motherearthmerch.com, a website that lists clothing for sale. The registrant name of motherearthmerch.com is “Dakota Patterson,” however; the registrant email address is masonghrannie[at]protonmail.com. According to his 49
LinkedIn profile, Mason Ghrannie is the Vice President of CBD’R US, the brand name that appears on wercbdstore.com. We note that cbdrustore.com now auto-redirects 50
to wercbdstore.com.
Based on our analysis of this transaction, it appears that motherearthmerch.com is processing payments for wercbdstore.com (formerly cbdrustore.com).
4.1.2 Another Transaction Laundering Example
In our work with payments partners, LegitScript has confirmed instances of transaction laundering for CBD. Sellers have applied for merchant accounts for products such as essential oils, grooming products, teas, and more.
For example, the merchant to the right ostensibly offered acrylic nails for sale, but the website was minimal and showed signs of neglect.
https://opencorporates.com/companies/us_wy/2019-00086169648
https://www.godaddy.com/whois/results.aspx?domain=motherearthmerch.com49
https://www.linkedin.com/in/mason-ghrannie-7a0b0217a/50
31
legitscript.com | 877-534-4879 | [email protected]
The website included no contact information to establish the legitimacy of the business, and there was no other internet presence, such as social media or user reviews.
However, the email address used in the operator’s merchant account application was associated with a social media account (shown right) and an offline URL that had historically facilitated the sale of CBD. Using these data points, we were able to connect these CBD sales back to the nail merchant and confirm transaction laundering.
4.2 Offshore Processing
Offshore payment processing can come with risks for both buyers and sellers. For consumers, purchases can result in unexpected cross-border fees. For sellers, there may be higher fees and less regulatory oversight than with companies in the US that are subject to US laws. 51
During our website survey (see Section 1) we observed many websites that listed both US and foreign addresses, most of which were in the European Union.
FIG 32: A CBD WEBSITE LISTING BOTH US AND UK ADDRESSES
https://t1payments.com/offshore-payment-processing-know/51
32
legitscript.com | 877-534-4879 | [email protected]
The UK address in the image on the previous page appears to be a virtual office, the purpose of which may be to provide a base of operation in the EU for payment processing or tax reasons, though we were unable to confirm this. We also observed that many apparently unrelated CBD websites listed the same European addresses. 52
During our product purchases, eight test transactions on merchants based in the US resulted in unexpected cross-border transaction fees, which indicates that the merchants are utilizing payment processors located outside of the US.
Five of the test transactions associated with cross-border fees resulted in unique
merchant descriptors containing UK phone numbers. All the merchants appear to be
based in the US (or at the very least are targeting US customers); however, they also list
addresses in Great Britain, Northern Ireland, or Spain on their respective websites.
4.3 Other High-Risk Behavior
During our website survey, we observed some online CBD sellers engaging in other behavior that typically draws scrutiny from payment service providers and is often a violation of their terms and conditions. See the subsections on the following pages.
4.3.1 Multilevel Marketing
We identified 19 CBD sellers that were multilevel marketing (MLM) organizations. While some MLM programs, also called direct selling programs, are legitimate and non-predatory, others fit the model of pyramid schemes, which are illegal in many jurisdictions. In a pyramid scheme, a distributor’s income is based primarily on the number of people they can recruit and the money those new recruits pay to join the company — not on the distributor’s product sales to the public. Businesses offering MLM programs have also been known to scam their distributors by overselling their products and promising high returns, or for offering unfavorable return policies to the buyer. For this reason, MLM programs are frequently the target of action by the Federal Trade Commission (FTC) for unfair and deceptive practices. 53
Example: https://www.google.com/search52
https://www.legitscript.com/dl/udaap-guide53
33
legitscript.com | 877-534-4879 | [email protected]
FIG 33-34: EXAMPLES OF CBD MLM ORGANIZATIONS SUGGESTING LARGE PAYOUTS
According to “The Case (for and) Against Multi-level Marketing,” a report prepared by the Consumer Awareness Institute and solicited by the FTC, virtually every distributor who participates in an MLM program loses money, regardless of the type of program: “With every MLM, where such data was available, and after debunking the deceptions in their reporting, the loss rate was at least 99%, using liberal assumptions relating to retention and cost of participation … .” 54
Because of the deceptive nature of many of these programs, payment service providers often ban MLM companies in their terms and conditions.
https://www.mlmwatch.org/01General/taylor.pdf54
34
legitscript.com | 877-534-4879 | [email protected]
4.3.2 Marketing Affiliates
Both MLMs and traditional B2C companies often employ the use of affiliate marketing to help market and sell their brand. With non-MLM affiliate programs, an online merchant typically pays another website operator a commission to send them traffic or otherwise sell on their behalf. Commission may be based on the amount of traffic an affiliate sends, or a percentage of sales attributed to the affiliate traffic.
FIG 35: EXAMPLE OF A CBD SELLER’S AFFILIATE MARKETING PROGRAM
Affiliates aren’t inherently problematic. For example, Amazon offers an affiliate program that has potentially hundreds of thousands of participants who send traffic to the e-commerce giant. The risk, however, is that affiliates may use messaging that 55
can draw regulatory scrutiny, such as impermissible marketing claims. Gordon Law Group, which specializes in online businesses, e-sports, and e-commerce, states that “if an affiliate flouts FTC rules, the brand could be held 100% responsible.” 56
Furthermore, affiliates may be responsible for disclosing that they receive a commission for marketing products. According to the FTC Endorsement Guides, affiliates must disclose when they are using affiliate links to adhere to the truth-in-advertising principle. 57
https://blog.geni.us/just-big-amazon-associates-program/55
https://www.gordonlawltd.com/ftc-v-pom-wonderful-lessons-for-affiliate-marketers/56
https://www.ftc.gov/tips-advice/business-center/guidance/ftcs-endorsement-guides57
35
legitscript.com | 877-534-4879 | [email protected]
At least 30 of the websites we surveyed offered affiliate programs. Because both supplements and CBD are considered high-risk industries, affiliate programs in these spaces may warrant additional scrutiny.
4.3.3 Negative-Option Billing
Negative-option billing is a deceptive approach to ensnaring consumers in ongoing subscriptions without their express consent. The FTC recently highlighted the practice as a major focus of enforcement. Also known as continuity marketing, it is a practice in which the consumer’s failure to reject an offer or cancel an agreement is interpreted as confirmation that they want to be charged for goods and/or services.
Essentially, these merchants are misleading their customers into signing up for subscriptions or recurring purchases without customers’ express consent. Merchants engaged in this practice pose risk for regulatory and card brand scrutiny, as well as elevated risk for chargebacks.
Merchants engaged in negative-option billing differ from merchants offering a simple subscription or recurring service. Red flags include:
• The merchant obfuscates its billing terms (for example, by using small print or making the terms difficult to find).
• The merchant provides complex and potentially misleading billing terms (for example, the customer must cancel within 18 days, fours days of which are shipping days, to avoid a charge of $99.95).
• The merchant’s website uses a common template that provides little information about the product offered and focuses on encouraging customers to sign up for a “free trial” that may result in a substantial follow-up charge.
36
legitscript.com | 877-534-4879 | [email protected]
FIG 36: THIS WEBSITE DISPLAYS INDICATORS THAT PRESENT RISK OF A NEGATIVE-OPTION BILLING SCHEME, THOUGH LEGITSCRIPT DID NOT MAKE A PURCHASE TO CONFIRM THIS.
Dietary supplements and cosmetics are common products used for negative-option billing, which may put CBD products at an elevated risk. In our website survey, we identified 33 CBD sellers offering subscriptions. Two of these presented possible indicators of negative-option billing: high-pressure marketing, limited product information, and automatic subscription sign-up. We did not, however, complete purchases through these websites.
37
legitscript.com | 877-534-4879 | [email protected]
5. Conclusion and Recommendations
Although hemp and its products have long been a part of the agricultural tradition in the United States, legislative efforts in previous decades have stymied production and research. Now, with the passage of the 2018 Farm Bill and increasing public interest in cannabidiol, the CBD market is poised to flourish in the coming years.
This rapid expansion is exciting for the industry but cause for consumer and regulatory concern. Hemp and CBD manufacturers are becoming legitimized, which may help give them better access to important financial services to grow their businesses. But rapidly growing 58
industries that offer the promise of quick payouts are ripe for abuse. The challenge for the CBD industry will be to balance consumer safety with industry needs. The tension between these two will continue to complicate the CBD landscape.
Here are some key takeaways from our research:
• 98% of websites we surveyed were noncompliant in one or more categories. This took into consideration the types of products sold, the shipping locations of sellers and buyers, and the marketing claims a seller made about CBD’s potential to cure, treat, or prevent diseases.
• However, some of this problematic activity is fixable. See our recommendations on the next page for industry best practices, including voluntary compliance and the use of certification and monitoring processes by payment and internet companies.
• 63% of surveyed websites posted no lab results, a critical component of transparency to consumers. An additional 13% posted old or partial lab results.
• About two-thirds of products we tested contained significant deviations in CBD potency. One product contained more than twice the amount of CBD it listed; another contained a mere 1% of the CBD it said it had.
• Two of the 30 products we tested contained potentially dangerous substances, including lead and ethylene oxide.
https://hemptoday.net/hemp-banking-usa/58
38
legitscript.com | 877-534-4879 | [email protected]
• Some CBD sellers appear to be engaged in high-risk financial activity, including transaction laundering, offshore payment processing, negative-option billing, and multilevel marketing.
5.1 Solutions
While the CBD industry faces many challenges, we also see many opportunities for CBD sellers to navigate regulations, grow their business, and demonstrate compliance. Many fixes are relatively simple and can be made quickly with the help of an expert’s eye.
1. Fix Jurisdictional Noncompliance
The vast majority of websites we surveyed appear to ship to states where CBD is not permitted. This is technically an easy fix that may have a limited impact on a seller’s bottom line. A website operator need only remove these states from the checkout page’s drop-down menu, or post an error message when a customer enters an address in one of these states. The more difficult part is in knowing which states allow CBD shipments and which do not. As we mentioned in Section 2.2, state laws are often complex and confusing. A policy partner, such as LegitScript, can help navigate these laws.
2. Remove Impermissible Marketing Claims
A primary focus of regulation in the CBD industry by both the FDA and FTC is health 59
claims being made that these products can cure, treat, or prevent serious diseases. This is not only against the law, but also does consumers a disservice. At best, vulnerable populations are given false hope; at worst, they may forgo proven treatment in favor of an unproven solution. By removing disease claims from websites, testimonials, and social media, CBD sellers can prove to regulators and customers that they care about consumer safety and want to work within the regulatory framework to grow their business. A certification and monitoring partner, such as LegitScript, can help you understand what types of statements are allowable and which are not.
https://www.ftc.gov/news-events/press-releases/2019/09/ftc-sends-warning-letters-companies-advertising59
39
legitscript.com | 877-534-4879 | [email protected]
3. Get CBD Products Certified by LegitScript for Free
Customers still have serious concerns about who they can trust and whether the products they are buying are dangerous. Few standards exist, and some that do come from within the industry itself, which can be problematic.
LegitScript’s CBD Certification for products and websites provide the legitimacy CBD sellers have been looking for, and the credibility that the industry desperately needs. As the leading third-party certification expert in complex healthcare sectors, LegitScript works with regulatory authorities, credit card companies, major search engines, and e-commerce platforms around the world, including Visa, Google, Bing, Facebook, and Amazon.
Our certification program is unique because it requires much more than product testing: it looks at supply chain, business best practices, transparency, marketing claims, jurisdictional compliance, and more. Our policy experts help good-intentioned CBD sellers come into compliance in areas such as shipping regulations and marketing claims so that they can sell with confidence.
As a show of our commitment to public safety, LegitScript is currently offering free LegitScript CBD product certification for a limited time. By waiving our standard 60
pricing — including product application and monitoring fees — the power of LegitScript certification is within reach for any CBD seller.
At the core of LegitScript’s mission is to protect consumer safety. We believe it’s possible to safeguard the public while also helping companies in high-risk industries, such as CBD, grow their businesses and thrive.
LegitScript appreciates the opportunity to present this research and welcomes questions at [email protected].
https://www.legitscript.com/service/certification/cbd/ (Website/merchant certification continues to be a paid 60
service at previously published pricing.)
40
